# CVE-2026-121927: InfiniFlow RAGFlow server-side request forgery in Seafile Connector

Source: https://junglewise.ai/threats/cve-2026-121927-a-vulnerability-has-been-found-in-infiniflow-ragflow-up-to-0-27  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-11-04. Updated: 2026-11-04  
License: CC BY 4.0 with a link back

CVE-2026-121927 · Severity: medium · CVSS 6.3 · Published 2026-11-04

InfiniFlow RAGFlow is a document processing and retrieval system that integrates with Seafile cloud storage. A vulnerability in the Seafile Connector component allows remote attackers to manipulate the seafile_url parameter, causing the server to make unauthorized requests to internal or external systems. This could lead to exposure of sensitive internal services, data exfiltration, or further network compromise.

Technologies: [InfiniFlow RAGFlow](https://junglewise.ai/threats/technologies/ragflow). Vendors: [InfiniFlow](https://junglewise.ai/threats/vendors/infiniflow).

## Quick answers

**Is CVE-2026-121927 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-121927 being exploited in the wild.

**How severe is CVE-2026-121927?** Medium severity, with a CVSS score of 6.3, published 4 November 2026.

**Which products and versions are affected?** InfiniFlow RAGFlow up to 0.27.3.

**Is there a fix for CVE-2026-121927?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-121927 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-121927?** Check whether you run InfiniFlow RAGFlow at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A server-side request forgery (SSRF) vulnerability exists in the _account_get function within the Seafile Connector component (common/data_source/seafile_connector.py). The vulnerability arises from improper validation of the seafile_url argument, allowing attackers to inject malicious URLs. The attack is remotely exploitable and does not require authentication or user interaction.

## Affected products

- InfiniFlow RAGFlow up to 0.27.3

## Timeline

- 2026-11-04: disclosed

## References

- [https://vuldb.com/cve/CVE-2026-121927](https://vuldb.com/cve/CVE-2026-121927)
- [https://vuldb.com/submit/1023351](https://vuldb.com/submit/1023351)

## Related threats

- [RAGFlow server-side request forgery in LLM API key endpoint](https://junglewise.ai/threats/cve-2026-49951-ragflow-before-0-27-0-contains-a-server-side-request-forgery)
- [InfiniFlow RAGFlow authorization bypass in Text To SQL Retrieval](https://junglewise.ai/threats/cve-2026-121585-a-security-flaw-has-been-discovered-in-infiniflow-ragflow-up-to)
- [RAGFlow authorization bypass in OpenAI-compatible agent completion](https://junglewise.ai/threats/cve-2026-119337-ragflow-is-an-open-source-rag-retrieval-augmented-generation)
- [RAGFlow improper access control in get_dataset API endpoint](https://junglewise.ai/threats/cve-2026-51897-ragflow-0-24-0-contains-improper-access-control-in-get-dataset)
- [infiniflow RAGFlow improper access control in resume API](https://junglewise.ai/threats/cve-2026-51896-infiniflow-ragflow-0-25-3-contains-improper-access-control-in)